holetron-lab/fleet-memory
1
0
Fork 0
Code Releases Packages Activity Actions

chore(ci): drop dependabot — the mirror deletes its branches before they can land

Browse source 
GitHub is a push mirror of the Forgejo canon, not a peer. The sync force-matches
refs, so every branch dependabot opens is deleted within the hour and its PR
closes itself. Two runs proved it (checkout 4->7 and setup-node 4->7, both
opened 2026-08-24, both auto-closed): the loop cannot land a change, and a
public repo whose only PRs are self-closed bot PRs reads as abandoned.

The bot's one useful output was taken by hand — publish.yml already pins
actions/checkout@v7 and actions/setup-node@v7, shipped in 0.1.0.

FORK.md records why, so restoring the file is a decision and not an oversight.
This commit is contained in:
RCLL 2026-08-28 16:23:27 +03:00
parent 77ea122dc9
commit 3074417d64
2 changed files with 21 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
.github/dependabot.yml vendored
View file

@ -1,6 +0,0 @@
version: 2
updates:
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "weekly"

21
FORK.md
View file

@ -122,3 +122,24 @@ upstream https://github.com/vectorize-io/hindsight.git (push URL deliberately
and this repository is one decision away from being made public with an already
published `server.json` — a rewritten history is a one-way door. The series
lives on its own branch; repointing `main` is the owner's call.
## Dependency updates: why there is no dependabot
`.github/dependabot.yml` was removed on 2026-08-28. It was not failing — it was
running in a loop that could never land.
GitHub is a **push mirror** of the Forgejo canon, not a peer. The mirror sync
force-matches refs, so a branch dependabot opens on GitHub is deleted within the
hour and its pull request closes itself. Two runs proved it (`bump
actions/checkout 4 → 7` and `bump actions/setup-node 4 → 7`, both opened
2026-08-24, both auto-closed). A public repository whose only pull requests are
self-closed bot PRs reads as abandoned, which is the opposite of what the bot is
for.
The bot's one useful output was taken by hand: `.github/workflows/publish.yml`
now pins `actions/checkout@v7` and `actions/setup-node@v7`, and that upgrade
shipped in the 0.1.0 release.
Action versions are therefore bumped on the canon, by hand, when the workflow is
touched. If GitHub ever becomes the canon rather than a mirror, restore the file
— the loop closes only because pushes are one-way.